NeuralStackTrendAI’s Zero Day Initiative (ZDI) has published a fresh slate of security advisories, exposing vulnerabilities across core internet software, enterprise platforms and mainstream consumer devices. The newly listed flaws range from denial-of-service issues and information disclosure to remote code execution and local privilege escalation, with many rated high or critical on the CVSS scale. While affected vendors work on or provide fixes, the disclosures highlight how varied and persistent the attack surface has become, from data center Linux kernels to smart plugs in homes.
Among the most consequential items in the latest batch is a remote code execution vulnerability in the NGINX HTTP Dav module, tied to the alias directive and described as an integer underflow issue (ZDI-26-578, CVE-2026-27654). Rated 8.1, the bug could allow attackers to execute code on affected servers, putting web-facing infrastructure at risk if left unpatched. NGINX’s role as a widely used web server and reverse proxy means this advisory will be closely watched by hosting providers and DevOps teams.
Email and file scanning infrastructure is also in play, with a Clam AntiVirus 7z archive parsing integer overflow leading to remote code execution (ZDI-26-583, CVE-2026-20215). Because ClamAV is often deployed as a key layer in mail gateways and storage scanning pipelines, a flaw in 7z handling opens a path where a carefully crafted archive could compromise security services intended to defend the environment. The vulnerability’s 8.4 score reflects the seriousness of turning a security control into a potential initial access point.
Cisco’s Identity Services Engine (ISE), a cornerstone of many enterprise network access control deployments, appears multiple times in the August 13 advisories. The issues span directory traversal for information disclosure (ZDI-26-582, CVE-2026-20148), command injection that can lead to remote code execution (ZDI-26-581, CVE-2026-20147), missing authentication on critical functions exposing information (ZDI-26-580, CVE-2026-20190), and a zipFiles directory traversal that can be abused for remote code execution (ZDI-26-579, CVE-2026-20181). Together, they paint a picture where missteps in input handling and access controls could be chained in sophisticated attacks on network policy infrastructure.
Linux kernel bugs dominate the latest ZDI entries, with a cluster of race conditions and memory-safety issues leading to local privilege escalation and information disclosure. Advisories describe problems in components such as the XFRM subsystem, various Net Scheduler paths, the IGMP subsystem, and the True Link Equalizer, many rated 7.5 or higher for their ability to let a local attacker escalate privileges. One of the most severe entries, a KSMBD response header out-of-bounds read (ZDI-26-573, CVE-2026-68431), carries a 9.3 rating for information disclosure, underlining that kernel-level protocol handling remains a difficult area to secure.
TrendAI’s list also underscores how auxiliary security and systems tools can become escalation footholds. Norton Utilities Ultimate is flagged for a link-following local privilege escalation via the NortonUtilitiesSvc service (ZDI-26-567, CVE-2024-13962), while Gen Digital’s CCleaner has a similar link-following privilege escalation issue (ZDI-26-565, CVE-2026-12410). NVIDIA’s Transformers4Rec machine learning library is impacted by a deserialization of untrusted data problem in the load_model_trainer_states_from_checkpoint function, again leading to potential remote code execution (ZDI-26-564, CVE-2026-24232), illustrating that even specialized AI tooling is now squarely in attackers’ sights.
Industrial and embedded platforms are not spared, with BlackBerry QNX facing a file parsing out-of-bounds write in its KEV component that can result in remote code execution (ZDI-26-566, CVE-2026-40272). In parallel, Trend Micro’s VPN product appears under the TrendLife label with an OpenSSL configuration issue described as an uncontrolled search path element, enabling local privilege escalation (ZDI-26-577, CVE-2026-67212). These advisories show how low-level file and library handling bugs can bubble up into high-impact security risks on systems often considered hardened or specialized.
Pwn2Own discoveries from the Home Assistant Green and Amazon smart plug ecosystems further broaden the impact into the smart home. Multiple Home Assistant entries cover server-side request forgery via Simple Service Discovery Protocol and mDNS (ZDI-26-563, ZDI-26-562), as well as command injection vulnerabilities in the go2rtc component that can lead to remote code execution (ZDI-26-561, ZDI-26-560). For Amazon’s smart plug, ZDI calls out an out-of-bounds write in the OTA update process enabling remote code execution (ZDI-26-559), improper certificate validation during updates (ZDI-26-558), and an insecure fallback mechanism exposing information (ZDI-26-557).
Why this matters
The breadth of these advisories shows that attackers no longer need to choose between targeting cloud infrastructure, enterprise policy engines, kernels or consumer devices—viable bugs now exist in all of them at once. Remote code execution in NGINX, ClamAV, NVIDIA’s AI tooling and Home Assistant Green offers entry points, while Linux kernel privilege escalations and service-level flaws in Cisco ISE, Norton Utilities and CCleaner provide paths to deepen compromise. When those are combined with insecure smart plug firmware update paths and IoT server-side request forgery, defenders are forced to secure a vastly heterogeneous attack surface that stretches from racks in data centers to the power outlets in living rooms.
Many of the latest ZDI findings hinge on recurring classes of implementation problems—race conditions in the Linux kernel, unsafe deserialization in AI libraries, exposed dangerous functions in Parallels RAS Client components (ZDI-26-556, ZDI-26-555, ZDI-26-554), and insufficient validation in firmware update and discovery protocols. That pattern underscores the need for more systematic secure development practices, particularly in performance-critical kernel code and in the fast-moving AI and IoT stacks where speed to market often competes with thorough hardening. As vendors roll out their patches and ZDI’s advisories circulate, the next few weeks will be a test of how quickly organizations can inventory their exposure, prioritize the most severe bugs, and deploy fixes across an ecosystem that now spans everything from VPN clients to smart plugs.